The Mail Mint WordPress plugin is vulnerable because the process_contact_attribute_import function does not validate the type of files that an authenticated user, specifically those with Administrator-level privileges or higher, can upload. This omission allows an attacker to upload any file to the site’s server, potentially introducing executable code. The weakness is covered by CWE‑434 and can lead to remote code execution if the attacker forges a malicious script or executable.

The vulnerability exists in all versions of the Mail Mint plugin—developed by getwpfunnels—up to and including 1.18.10. Administrators or users with similar or higher privileges running the plugin under any WordPress installation are susceptible.

The CVSS score of 7.2 indicates a high level of severity. The EPSS score is reported as less than 1 %, suggesting that, while the vulnerability is serious, the probability that it will be actively exploited in the near term is low. Because exploitation requires authenticated access, attackers need to compromise an administrator account or use another admin‑level account, which mitigates the risk compared to a publicly exploitable flaw. The flaw is not listed in the CISA KEV catalog. The most probable attack vector is an administrator legitimately logged into the WordPress dashboard who performs the contact attribute import action.